19 million patients, 12,000 clinics, 2.5 terabytes — and a government that will not call it an attack.
Abbott confirmed unauthorised access to a limited number of systems. ShinyHunters claims thirty million rows. Almost everything in between is unestablished.
The final count on the Conduent intrusion landed above 62 million people — third-largest in US healthcare history, at a processor most of them have never heard of.
The remedy is 24 months of monitoring. The scanned passport stays valid for ten years.
Revenue-cycle software for thousands of hospitals. Billing data is clinical data wearing an accounting costume.
Ambulatory cardiac data is continuous, and continuous physiology is a behavioural record collected for a clinical reason.
A claimed 8.8 TB from legacy patient archives. Every property that makes a legacy system low priority makes it high value.
Extortion refused, 234 GB published, 2.6 million addresses verified. The refusal produced a record that payment never does.
A nine-million-record claim against corporate IT, with device manufacturing reported untouched. The separation is the finding.
Hospitals flat, their suppliers up ~35%. Hardening one class of victim redistributes attacks rather than preventing them.
Ambulances diverted, chemotherapy infusions cancelled, a fortnight on paper. The affected people experienced it as a phone call.
A three-month intrusion at the largest US public health system took biometric records among the 1.8 million affected. Credit monitoring does not cover a palm print.
$900,000 a day against demands in the low millions. Printing those two numbers together constructs the attacker’s argument for them.
About 92,000 people at a Puerto Rico hospital. Diversion planning assumes somewhere to divert to.
A reported $100 million demand against a Japanese teaching hospital, and about 131,700 people. Only one of those numbers means anything.
The sector with the slowest patch cycle accumulates the most exposure. That needs no prediction about attacker capability.
Documents contain narrative. They describe a person’s condition in terms anybody can read.
One fix is cheap and nobody is doing it: emergency services already record diversion times. Nothing links them to incident dates.
A hospital carries the operational-technology problem of a utility alongside the data-protection problem of a bank.
Two files now where the market regulator surfaced an incident the data regulator would not have.
A patient chooses a practice. The practice chooses the software. The patient has no relationship with the supplier and cannot change it.
Five names, five sectors, one explanation. A list of five describes the head of a very long distribution.
The visibility explanation this desk applies elsewhere is much weaker here. A leak site names whoever the attacker chose to name.
A dark-web listing is read by a professional audience. A Telegram channel is read by neighbours and employers.
One episode of care generates records in six organisations — six independent breach exposures for the same history.
Health leading a universal register is a stronger finding than health leading a sector-specific one.
Every year the largest healthcare breach happens at a company patients have never heard of. That is where the data pools.
The published “we don’t hit hospitals” rules were positioning. An operation whose affiliates pick the victims cannot implement a sector exclusion.
A third of hospitals say incidents affected care. It measures disruption, not harm — and it still moves the funding argument.
A settlement fund is not an assessment of harm. It is the price of resolving a dispute — here, $6.60 a head.
343 mandatory filings in six months. Healthcare tops breach tables partly because it is the only sector compelled to count.
The reporting duty tracks the sensitivity of the record. The security expectation tracks the sector of the company.
5.4 million through a subsidiary of the group that had already produced the largest healthcare breach on record.
600 applications withdrawn in a live hospital. Most people guess a few dozen; nobody can say what each one would break.
One vendor incident becomes many provider notifications on different dates. Anyone counting breaches sees several small ones.
Nineteen days inside a dialysis provider, 2.7 million records taken, and treatment never stopped. The continuity is the underreported part.
Per-capita recovery falls as the class grows. The largest incidents in this database have the weakest claim on the mechanism.
More affected people than the state has residents. Healthcare is the one sector where “delete what you don’t need” runs into real counter-pressure.
Not “nearly three million” — 2,947,264. Healthcare produces exact counts because every affected person must be notified.
EMS already records diversion status and transport time. What does not exist is any mechanism connecting it to a cyber incident.
934,000 patients, a closed laboratory, and an internal emergency posture that already had a name for this.
The corpus does not record availability harm less because it matters less. It records it less because nothing compels anyone to measure it.
One paid and the data circulated anyway. One refused and the data was published. The suppression half delivered in neither case.
It did not grow because the intrusion grew. It grew because working out whose records sit in four terabytes takes eleven months.
Universal donor blood exists for trauma, not for encrypted laboratories, and it happened to fit. That is luck rather than planning.
The standing objection to everything this database says about availability harm is that nobody can show it reaching a person. Here a trust did.
Those are not records lost. They are appointments that did not happen, to people who were already waiting.
A hundred and forty hospitals losing their record system is not a proportionate consequence of one download. What sits between is everything it was allowed to reach.
The fallback held for a month across 140 hospitals — because enough staff had worked that way before. That is a resource with a retirement date.
A member looking up a condition is not browsing. The page is what reveals the worry.
The practical entitlement reads: you will be told, unless telling you costs more than the organisation has left.
A victim negotiating with the brand is negotiating with the party that holds the least. The files sit with the affiliate.
A company that pays quietly and says nothing has taken the cheaper path. The sample of known payments is not a sample of payments.
Encryption is the moment the attacker chooses to be seen. It happens after the theft, because the theft is the leverage.
A written requirement that MFA be enabled everywhere is not a control. It is intent somebody then has to enforce against an estate nobody has fully inventoried.
The pressure did not run through the hospital at all. It ran through the patients.
14,000 accounts to 6.9 million people. The multiplier was a feature, working as designed.
Diversion is the rare availability harm that produces a number — in minutes, measured by the ambulance service.
An initial figure measures how far a review had got, not how large an incident was.
The campaign is unmeasurable. Its individual victims are not.
The system with the weakest claim to protection held the widest population. Breadth is what a mail-merge store is for.
The fatal injury was to cash flow, and it took two years to prove fatal.
Every remedy this database records requires a living person to take an action.
Pharma is permitted. Dentists are permitted. The line falls where a death could be attributed.
Not a dump. A selection — sorted by which procedure would hurt the patient most.
No credential stolen, no flaw exploited. Somebody wanted to understand how patients used the portal.
623,700 had data exposed. The people actually harmed were the ones whose procedure moved.
Something noticed on day eleven. The judgement applied to it is what failed.